Plugins

Security-audit methodology skill pack plus the plugin_vet supply-chain gate: eight agent skills (secret scan, dependency audit, supply-chain review, prompt-injection review, audit orchestration, threat modeling, vuln intel, incident response) in Chinese and English editions, with an npm provider bundle that mounts the skills and registers the automated plugin_vet pre-install scanner.

Vets third-party plugins before you trust them: static scan for malicious patterns (exfiltration, credential access, obfuscation, persistence) and over-privileged path use, transitive-dependency coverage, official-package hash baseline for supply-chain tamper detection, and an optional plugin-tool call gate.

Plugin trust pipeline for DeepSeek Harness: deterministic static scan with verdicts, opt-in runtime guard with honeypot lures, agent audit-protocol skill, and a browser shield status light. Alarm-only, never an enforcer.

Plugin development toolkit for DeepSeek Harness with scaffolding, contract checks, plugin vetting, impact analysis, and upstream compatibility tracking.

Vets local, npm, and GitHub plugin source before installation, blocks configured high-risk tool calls at runtime, audits output secret patterns, and writes HMAC-chained local audit logs.

装第三方插件之前，先看它会动什么

Cut LLM costs: a Jev (System One) classifier vets each turn against a declarative policy and recommends the subagent model route, so routine work runs at flash rates while the main model keeps the hard parts; explicit /route trigger, runtime delegation-capability gate, credential redaction, and offline policy replay over the verdict log.

Pre-install static audits for npm-installable DSH plugins; emits and validates the open `dsh-vet/v1` report with severity, confidence, evidence, derived grades, a CI Action, and auditable badges.

A curated plugin starter pack: batch-installs and configures 15 vetted community plugins across four groups from a Settings-page UI or the /setup command.

Ecosystem-wide plugin health audit: syncs the dsh-plugin topic into a local scored catalog (maintenance / docs / npm + weekly downloads / ecosystem, 0-100, A-D), static security scan with high-finding grade veto, star history snapshots, web leaderboard and agent tools.

Yijing-based decision review plugin for DSH: six-layer weighted aggregation engine (384 yao to taiji) with strong-association veto rules, pure JS with zero solver dependencies. Free tier is capped at 9 runs per day and activation codes raise it; the stock-trend scenario pulls live quotes from Tencent for the stock codes in the request.

Renders installed DSH plugin titles and descriptions in Simplified Chinese: at startup it translates the plugins the local JSON cache lacks through the harness LLM service, then projects { en, zh } metadata for resolveText() to render — no DOM changes, no third-party API.

Plugin compatibility vet for dsh that compares installed plugins peerDependencies against the running dsh version to flag which ones the startup preflight will refuse to load, prints copy-pasteable fix commands, and offers a top-of-page banner in dsh web to isolate, uninstall or upgrade them, with an automatic backup before the change and rollback if the re-check fails.

Quality & security scorecard for the DSH plugin ecosystem: sync the dsh-plugin topic catalog, audit any plugin (0-100, A-D, security veto), rankings, search, and historical score curves with a workspace-persisted catalog.

Pre-execution guardrail: vetoes dangerous shell commands and blocks secret/credential leaks before they run.